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Abstract — Based on ideas of Kotter and Kschischang [6] we use 
constant dimension subspaces as codewords in a network. We 
show a connection to the theory of q -analogues of a combinatorial 
designs, which has been studied in [1] as a purely combinatorial 
object. For the construction of network codes we successfully 
modified methods (construction with prescribed automorphisms) 
originally developed for the q-analogues of a combinatorial 
designs. We then give a special case of that method which allows 
the construction of network codes with a very large ambient 
space and we also show how to decode such codes with a very 
small number of operations. 

network coding, q-analogue of Steiner systems, subspace 
codes, constant dimension subspace codes, decoding. Singer 
cycle 

I. Introduction 

A. Subspace Codes 

In [6] R. Kotter and F. R. Kschischang developed the theory 
of subspace codes for applications in network coding. We 
will modify their presentation in some way. We denote by 
L{GF{q)'") the lattice of all subspaces of the ambient space, 
which is a vector space of dimension v over the finite field 
with q elements. The partial order of L{GF{q)'") is given by 
inclusion. A subspace code C then is a subset of L{GF{q)'"). 
A constant dimension code is the special case where all 
subspaces in C are of the same dimension. To study error 
correcting codes we have to define some distance between 
codewords (in this case codewords are subspaces). The most 
natural one is the graph theoretic distance in the Hasse 
diagram (vertices are the elements of L{GF{q)'") and two 
subspaces are connected by an edge if they are direct neighbors 
in the partial order) of the lattice L{GF{q)'"). An equivalent 
definition without using the underlying graph is as follows: 

The subspace distance between two spaces V and W in 
L{GF{qY) is defined as 

ds{V, W) := dim(F + W)- dim(T/ n W) 

which is equal to 

dim(l/) + dim(T/F) - 2 dim(l/ n W). 

This defines a metric on L{GF{q)'"). Like in classical cod- 
ing theory we define the minimum (subspace) distance of a 
subspace code C. 

Ds{G) := mm{dsiV, W):V,W eG and T/ 7^ W}. 
We can now define the optimal (subspace) code problem: 



(P) For fixed parameters q,v,d we want to find 
the maximal number m of subspaces Vi, . . . , Vm in 
L{GF{q)'") such that the corresponding subspace 
code C — {Vi,...,Vm} has at least minimum 
distance d. 

This is a specific instance of a packing problem in a graph. In 
classical coding theory the underlying graph is the Hamming 
graph. For network codes it is the Hasse diagram of the linear 
lattice. In the case of a binary code the Hamming Graph 
is isomorphic to the Hasse diagram of the powerset lattice. 
Using this connection we can look at the optimal (subspace) 
code problem as the q— analogue of the classical optimal code 
problem in the Hamming graph. To get the g— analogue we 
have to substitute a subset (= 0/1 sequence of length v) of 
size fc by a fc— dimensional subspace of GF{qy . The number 
of fc— dimensional subspaces of GF{q)'" is denoted by the 
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B. q— Analogues of Designs 

A t ~ (v, k, A) design is a set G of fc— element subsets 
(called blocks) of the set {1, . . . ,v} such that each i— element 
subset of {!,...,«} appears in exactly A blocks. The special 
case of A = 1 is called a Steiner system. Like in the 
subsection above we now define the g— analogue of a t- 
design. A t ~ {v, fc, A) design over the finite field GF{q) is 
a multiset G of fc— dimensional subspaces (called q-blocks) 
of the w-dimensional vector space GF{q)'" such that each 
t— dimensional subspace of GF{q)" is a subspace of exactly 
A q— blocks. The connection with the constant dimension 
codes is given by the following observation in the case of 
a Steiner system: Given a g— analogue of a t — (v, fc, 1) design 
G we get a constant dimension code of minimum distance 
2(fc — i + 1), since each t-dimensional space is contained in 
exactly one fc-dimensional subspace the intersection between 
two spaces from G is at most (t — 1)— dimensional. Therefore 
the minimum distance of C is at least 2(fc — i + 1). On the 
other hand given any {t — 1)— dimensional subspace V we can 
find two i— dimensional spaces U, W with intersection V and 
then two unique q— blocks containing U and W. The minimum 
distance between these q— blocks is 2(fc— i+l). g-analogues of 
designs were introduced by Thomas in 1987 [10]. Later they 
were studied in a paper by Braun et al. [1] where the authors 
constructed the first non-trivial g— analogue of a 3-design. We 
will describe a method in the second section which is based on 
their paper and which we use to construct constant dimension 
codes. First results found using that method were already in 
[7]. 



C. Encoding/Decoding 

In [6] the authors introduced the operator channel as a model 
to study subspace codes. The input and output alphabet of 
the channel is the lattice L{GF{q)'"). The transmission of 
an information coded by a space U works as follows: The 
transmitter inserts into the network vectors from U. During 
transmission the internal nodes of the network receive several 
such vectors and forward an arbitrary linear combination of 
the received vectors. The receiver collects the incoming vectors 
and tries to rebuild U as the space generated by the incoming 
vectors. There are two possible problems at the receiver There 
can be erasures, which means that some vectors are missing 
and the generated space is a subspace of U. Or there can be 
errors, which means that the receiver got vectors not from 
U. In the third section we will give a decoding algorithm for 
minimum distance decoding which allows error and erasure 
correction for a special class of constant dimension codes. 
This new method uses the symmetries of this special class of 
network codes, which were also studied by Etzion and Vardy 
[4], who called these codes cyclic. 

II. Construction of Constant Dimension Subspace 

Codes 

In the following we work only with constant dimension codes 
built by a collection of fc— dimensional subspaces of GF{q)'" 
of minimum distance at least 2(fc — i + 1) as described in 
section I-B. In [7] we gave a general method using a prescribed 
group G of automorphisms of a putative constant dimension 
code G to give an equivalence between the existence of such 
a code and a solution of a Diophantine system of inequalities. 
Therefore the construction of such a code G boils down 
to finding a (0/1)— solution a; of a Diophantine system of 
inequalities of the form; 



ikf^x < 
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The number of rows in M'^ is the number of orbits of G on 
the i— dimensional subspaces of GF{q)'" and the number of 
columns is the number of orbits of G on the fc— dimensional 
subspaces of GF{q)'". In [7] we described the general method 
for the construction using arbitrary automorphisms, and a 
further variant which is useful in the case of G equal to the 
group generated by a Singer cycle 5*. Orbits of the Singer cycle 
has been studied for several applications [3]. The nice property 
of the Singer cycle is that G ~ (S) acts transitively on the one- 
dimensional subspaces of GF(g)^. So we can label any one- 
dimensional subspace W by the unique exponent i between 

V 

1 

where V is some arbitrary one-dimensional subspace. Given 
a fc-space U (for 1 < fc < w) we can describe it by the set Pjj 
of one-dimensional (i.e. numbers between and /) subspaces 
contained in U. Given such a description of a fc-space U it 



and / :== 



— 1 with the property that W — g''V, 



is now easy to get all the spaces building the orbit under 

r fc 1 

the Singer subgroup G. Take the set Pjj of ^ numbers 

L J <j 
from {0, ■ ■ ■ ,1} representing the one-dimensional subspaces of 
GF{qY being also subspaces of U and now the action of S 
on a number in Pu is simply adding one modulo I. If we look 
at GF{q)'" as an field extension of degree v of the base field 
GF{q) this is the use of a primitive element uj and writing 
the elements of GF{q) using uj and an exponent. 

Example 1: We study the case g = 2,w = 5,fc = 2:A two- 
dimensional binary subspace contains three one-dimensional 
subspaces. We get a two-dimensional space by taking the 
two one-dimensional spaces labeled {0, 1} and the third one 
given by the linear combination of these two will have a 
certain number, in this example {14}. Therefore we have a two 
dimensional space described by the three numbers {0, 1, 14}. 
To get the complete orbit under the Singer subgroup we simply 
have to increase the numbers by one for each multiplication 
by a generator S of the Singer subgroup. The orbit length 
of the Singer subgroup is 31 and the orbit is built by the 
31 sets: {0, 1, 14}, {1, 2, 15}, . . . , {16, 17, 30}, {0, 17, 18}, . . . 
{12,29,30}, {0,13,30}. 

III. Real Coding 

In this chapter we will restrict to the case of a constant 
dimension subspace code built from a single orbit O of the 
Singer cycle on the 3— dimensional subspaces of GF{2)'" with 
the property that two subspaces of the orbit intersect in a 
subspace of dimension less or equal to one. We will call such 
an orbit a good orbit. The subspaces in a good orbit O form a 
code of minimum distance at least 4. This is a less restrictive 
version of the codes studied in [8] where a code was studied, 
where the subspaces intersect zero-dimensional. 

We describe a single subspace U in the orbit O by the 7 one- 
dimensional subspaces contained in U. As an example lets 
assume U = {0,1,4,10,18,23,25}. The orbit-type can be 
described by the two distance between wi , W2 £ U, i.e. the two 
exponents 11,12 of the generator S defined by S^^vi — V2 and 
S^^V2 = wi. In this example it is visualized by the complete 
graph Kv with vertices from V and edge-labels given by the 
the smaller distance. For this concrete example we get: 
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If we take a different subspace from O the vertex labels 
are increased by a fixed number, but the pairwise distances 
remain unchanged. We denote by Kq the complete graph with 
7 points without vertex-labels and edge-labels given by any 
V ^ O. The following observation is crucial for the proposed 
algorithm for decoding: 

Lemma 1: All edge-labels in Kq are different. 

This is because otherwise we would have no orbit where two 
subspaces intersect at most one-dimensional. This property 
is similar to the questions studied in the theory of finite 
difference sets or Golomb rulers (e.g. [2] p.419ff). Above 
labeling comes from an optimal Golomb ruler. It is not clear 
whether there is a primitive element in GF{2'") such that we 
get a vector space using above exponents. 

If we work with the field GF{2'") instead of the vector space 
GF{2)'", than above graph is constructed using the elements 
{vi, . . . ,v^} of a subspace as labels of the vertices and the 
two quotients Vi/vj and Vj/vi as labels of the edges. 



A. Decoding 

There are two cases, which have to be checked for decoding. 

1) Erasure Case: The first one is an erasure, meaning that we 
receive only a two-dimensional subspace U, represented by 
two of the three one-dimensional subspaces U = {r,s}. The 
idea now is to identify the two vertices in Kq corresponding 
to these two elements r and s. To do this we only have to 
compute the quotient (in the field GF{2'") ) of the two field 
elements r and s. And using the result we can lookup the 
corresponding edge in Kq and get vertex labels by taking r 
and s. After that we use one further application of some power 
of the Singer cycle (i.e. multiplication in GF{2'")) to get a 
third independent vector, which finished the reconstruction of 
the transmitted vectorspace. 

Therefore decoding including error correction in the erasure 
case is one division and one multiplication in GF{2'"). 

2) Error Case: The second case is that we received a vec- 
tor not in the transmitted space V. As we have minimum 
distance 4 the erroneous codeword we want to correct is a 
4— dimensional space U containing the transmitted codeword 
V. Again the idea is to identify the 3-dimensional subspace 
V inside U by looking at the pairwise distances. We start 
with 3 independent vectors r, s, i in U. We know that the 
space / generated by {r, s, t} intersects with F in a at 
least two dimensional space W. Now we loop over all 7 2- 
dimensional subspaces of / and for each such space we try the 
reconstruction like in the erasure case. We additionaly check 
whether the constructed third vector is in the received word 
U. If this is the case we have found the original codeword V. 

Therefore decoding including error correction in the error case 
needs at most 7 divisions and 7 multiplications in GF{2'"). 



B. Generalisations 

There are several immediate generalisations. Of course one can 
use n different orbits of the Singer cycle with the pairwise 
intersection property for all spaces in the n orbits. In this 
case you would have n • 21 possible pairs of distances (=quo- 
tients). One can also use fc— dimensional subspaces instead 
of 3— dimensional subspaces. In this case one has to look at 
(2^^ — l) (2'^ — 2) /2 pairs of distances and would get a code 
which allows to correct fc — 2 errors. In the non-erasure case 
error correction becomes more difficult as one has to study 
more two-dimensional subspaces. 

IV. How TO FIND A CODE 

In this section we give some arguments showing, that it is 
'easy' to find good orbits. We study the problem for arbitrary 
fc (not only fc = 3) and for arbitrary finite fields (not only 
q ~ 2). For the computation of an estimation how 'easy' it 
is we use a primitive element uj. For a 'real' application we 
represent the field elements by polynomials, as the internal 
nodes of the network have to compute linear combinations, 
meaning doing exor operations in the case of q = 2. 

We need to find one good orbit O of the Singer cycle 
such that all fc-dimensional (in the above special case we 
had fc = 3) subspaces intersect pairwise at most in a one- 
dimensional subspace. To do so, we choose arbitrarily fc 
representatives ai,a2,...,afe of one-dimensional subspaces 
generating a fc— space U represented by the one-dimensional 

r fc " 

subspace Pu = {60, • • • , &;}(with / = 



1 



- 1). If the 



( ^^) quotient pairs built form hi 



bj for i > j are all different 



(meaning that the subspaces generated from the quotient are 
different), the intersection of all elemens of the orbit of this 
space under the Singer cycle is at most one-dimensional. 
Thus, the elements of the orbit O form a code with minimum 
distance 2(fc — 1). In order to generate such a orbit, we first 
select a primitive element uj. Then we choose randomly the 
fc representatives of one-dimensional subspaces ai, 02, . . . , a^ 
by choosing fc random numbers e^ between and g" — 2 and 
setting Gi = uj^\ i = 1, . . . ,k. The subspace (oi, 02, ... , Uk) 
will be the generator of the orbit O. The probability that the 
dimension of (01,02, . . . ,ak) is less than fc is very small. In 
practice, for fc = 3 and q = 2 we choose ei = 0, 62 = 1 and 
a random number 1 < 63 < 2^ — 2. 

The property that all pairwise differences (mod q^ — 1) between 

r fc 1 

all non-zero elements of the subspace generated by 

J q 

ai, 02, . . . , flfe are different seems to be randomly distributed. 
For example, for two generators Ui and aj the integer number 
< X < g" — 2 with cj^ = fli + flj is likely to be 
hard to compute. It is called the discrete logarithm problem 
in cryptography. This problem is also closely related to the 
problem of computing the Jacobi logarithm [5], also called 
Zech's logarithm. There are no efficient (polynomial time) 



algorithms known to compute the discrete logarithm [9], also 
the discrete logarithm of the sum of arbitrary elements with 
known discrete logarithm as in our case seems to be without 
structure. 

The overall number m of possible pairs {bi,bj} (or pairs 
{ci — Cj mod q"" — 1, Cj—Ci mod q" ~1}) is equal to (q^ — 2)/2 
for q even, and [q" — 1) /2 for q odd. Let s be the number 
of (unordered) pairs of one-dimensional subspaces in a k- 
dimensional vector space. The probability that all s pairs 
{6i, 6j} are different is equal to 

mm m 

which is approximately 



1 - 



2m 



^-s(s-l)/2r. 



For example, for q ~ 2, v = 100 and fc == 3 we get s ~ 
(^'2"^) = 21, m = 633825300114114700748351602687 and 
therefore 

-s{s - l)/2m « -3.3132158019282496 • 10"^*. 

So, it is extremely unlikely to find a random orbit which does 
not fulfill the desired property. 

If we take the union of n orbits as our code we can apply the 
same estimation. For q — 2 we get 

n-(2'= -1) 
2 

In the example above, the expected number of orbits which 
can be combined without conflicts is 66 955 225 653 132. 
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